CVE-2025-14874

What it actually does

The flaw is a denial-of-service condition in Nodemailer's email address parsing logic. A specially crafted email address header can cause the parser to recurse indefinitely, eventually exhausting the JavaScript call stack or CPU resources in the Node.js process. In applications that parse untrusted email address headers using vulnerable Nodemailer code, this can cause request failures, worker crashes, degraded throughput, or repeated process restarts. The issue is not known to provide code execution or data disclosure; the primary impact is availability.

Why it matters to the business

Systems that use vulnerable Nodemailer parsing paths may become unstable or unavailable when they process maliciously formed email address data. This can disrupt email sending, inbound message processing, notification workflows, password reset delivery, customer communications, and background job processing. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV or known ransomware use, but the issue is inexpensive to trigger where user-controlled email headers are accepted, so internet-facing or automated mail-processing services should still prioritize remediation.

How an attack unfolds

An attacker identifies an application or service that uses a vulnerable Nodemailer version to parse email address headers or user-supplied email address fields. The attacker submits or sends a message containing a deliberately malformed address header designed to drive the Nodemailer address parser into infinite recursion. When the application processes the header, the Node.js runtime repeatedly descends through the recursive parser logic until the call stack is exhausted or the process consumes excessive resources. Depending on process supervision and error handling, this may produce repeated RangeError exceptions, failed jobs, HTTP 5xx responses, worker termination, queue backlogs, or service restarts. Repeated submissions can sustain the denial of service.

How to fix it

Update Nodemailer to a version that includes the upstream fix. For source/Git-based consumption, ensure the Nodemailer dependency includes commit b61b9c0cfd682b6f647754ca338373b68336a150 or later. Rebuild and redeploy all applications, containers, serverless functions, and worker images that bundle Nodemailer. Regenerate lockfiles where necessary so transitive or pinned versions are actually updated. If immediate patching is not possible, reduce exposure by validating and length-limiting email address headers before parsing, rejecting deeply nested or malformed address syntax, isolating mail parsing in supervised worker processes with restart limits, applying request/message rate limits, and adding queue backpressure so a small number of malformed messages cannot starve normal processing.

How to confirm the fix worked

Confirm the deployed dependency tree resolves Nodemailer to a fixed revision or release containing commit b61b9c0cfd682b6f647754ca338373b68336a150. Use package inventory, lockfile review, container image scanning, and runtime software composition analysis to verify that no vulnerable copy remains in application bundles or build artifacts. Exercise negative tests with malformed, overlong, and nested email address headers in a staging environment to confirm the parser rejects or safely handles them without stack exhaustion, high CPU, worker crashes, or repeated restarts. Monitor production after deployment for a drop in RangeError stack-overflow events, mail worker crashes, queue backlogs, and related HTTP 5xx responses.

Typical attack path

1. Identify a web application, API, mail gateway, background worker, or email-processing service that uses Nodemailer to parse email address headers.
2. Find an input path where attacker-controlled email address data is accepted, such as contact forms, invite workflows, notification recipients, inbound email processing, or message import features.
3. Submit or deliver a crafted email address header that triggers recursive parsing behavior.
4. Cause the vulnerable Node.js process to throw stack-exhaustion errors, become CPU-bound, crash, or restart.
5. Repeat the request or message delivery to keep the service degraded or unavailable.

How to detect it

To determine whether this was already exploited, review application logs, Node.js process logs, mail-worker logs, API gateway logs, queue-processing logs, and container orchestration events for stack-overflow exceptions or crashes occurring when email address fields or headers were parsed. Look for repeated `RangeError: Maximum call stack size exceeded` errors with stack traces referencing Nodemailer address parsing code, sudden Node.js worker exits, supervisor restarts, elevated CPU, rising queue depth, message reprocessing loops, and spikes in HTTP 500/502/503 responses on endpoints that accept recipient, sender, reply-to, invitee, contact, or inbound email data. Correlate failures with source IPs, authenticated users, message IDs, request paths, and timestamps to identify repeated malformed submissions. Because public exploit maturity is reported as none and no KEV or ransomware use is noted, detection should focus on reliability artifacts and parser exception patterns rather than known attacker infrastructure.

• RangeError: Maximum call stack size exceeded
• Maximum call stack size exceeded
• node_modules/nodemailer/lib/addressparser
• nodemailer/lib/addressparser
• addressparser
• RangeError
• UnhandledPromiseRejection
• uncaughtException
• JavaScript heap out of memory
• Node.js process exited
• npm package: nodemailer

What your security team should do

• Inventory applications, background workers, mail processors, and container images that include Nodemailer.
• Prioritize patching internet-facing services, inbound mail-processing systems, and any workflow that parses user-controlled email address headers.
• Upgrade Nodemailer to a fixed version containing commit b61b9c0cfd682b6f647754ca338373b68336a150 or later, then rebuild and redeploy dependent services.
• Add input validation and maximum length limits for email address fields and headers before they reach mail-parsing logic.
• Add monitoring for Node.js stack exhaustion, process restarts, abnormal CPU spikes, queue depth increases, and mail-processing failure rates.
• Review recent logs for signs of attempted exploitation, especially repeated parser exceptions associated with malformed email address input.
• Apply rate limiting and backpressure controls to APIs and queues that feed email parsing functionality.